<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>
<meta name="browsermode" content="application">
<meta name="apple-touch-fullscreen" content="yes">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-title" content="Axojhf的博客">
<meta name="apple-mobile-web-app-status-bar-style" content="default">
<meta name="msapplication-navbutton-color" content="#666666">
<meta name= "format-detection" content="telephone=no" />





  <meta name="keywords" content="知识点记录, nlvi" />


<link rel="apple-touch-startup-image" media="(device-width: 375px)" href="assets/apple-launch-1125x2436.png">
<link rel="apple-touch-startup-image" media="(orientation: landscape)" href="assets/apple-touch-startup-image-2048x1496.png">

<link rel="stylesheet" href="/blog/style/style.css">

<script>
  var nlviconfig = {
    title: "Axojhf的博客",
    author: "Axojhf",
    baseUrl: "/blog/",
    theme: {
      scheme: "banderole",
      lightbox: true,
      animate: true,
      search: true,
      friends: false,
      reward: false,
      pjax: false,
      lazy: false,
      toc: true
    }
  }
</script>




    
<link rel="stylesheet" href="/blog/script/lib/lightbox/css/lightbox.min.css">





    
<link rel="stylesheet" href="/blog/syuanpi/syuanpi.min.css">
















<style>
@font-face {
  font-family: "Allura";
  src: url('/blog/font/allura/allura.ttf');
}
</style>

  <title> Pwn题里有关seccomp和prctl函数的知识点小结 · Axojhf的博客 </title>
<meta name="generator" content="Hexo 4.2.1"></head>
<body>
  <div class="container">
    <header class="header" id="header">
  <div class="header-wrapper">
    <div class="logo">
  <div class="logo-inner syuanpi tvIn" style="display:none;">
    <h1><a href="/blog/">Axojhf的博客</a></h1>
    
  </div>
</div>

    <nav class="main-nav">
  
  <ul class="main-nav-list syuanpi tvIn">
  
    <li class="menu-item">
      <a href="javascript:;" id="search-btn" aria-label="Search">
        <i class="iconfont icon-search"></i>
      </a>
    </li>
  
  
  
    
  
    <li class="menu-item">
      <a href="/blog/" id="article">
        <span class="base-name">
          
            ARTICLE
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="/blog/archives" id="archives">
        <span class="base-name">
          
            ARCHIVES
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="javascript:;" id="tags">
        <span class="base-name">
          
            TAGS
          
        </span>
      </a>
    </li>
  
  
    
  
    <li class="menu-item">
      <a href="/blog/about" id="about">
        <span class="base-name">
          
            ABOUT
          
        </span>
      </a>
    </li>
  
  
  </ul>
  
</nav>

  </div>
</header>
<div class="mobile-header" id="mobile-header">
  <div class="mobile-header-nav">
    <div class="mobile-header-item" id="mobile-left">
      <div class="header-menu-item">
        <div class="header-menu-line"></div>
      </div>
    </div>
    <h1 class="mobile-header-title">
      <a href="/">Axojhf的博客</a>
    </h1>
    <div class="mobile-header-item"></div>
  </div>
  <div class="mobile-header-body">
    <ul class="mobile-header-list">
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-0">
          <a href="/blog/" >
            
              ARTICLE
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-1">
          <a href="/blog/archives" >
            
              ARCHIVES
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-2">
          <a href="javascript:;" id="mobile-tags">
            
              TAGS
            
          </a>
        </li>
      
        <li class="mobile-nav-item syuanpi fadeInRightShort back-3">
          <a href="/blog/about" >
            
              ABOUT
            
          </a>
        </li>
      
    </ul>
  </div>
</div>



    <div class="container-inner" style="display:none;">
      <main class="main" id="main">
        <div class="main-wrapper">
          
    
  
  <article class="
  post
   is_post 
  ">
    <header class="post-header">
      <div class="post-time syuanpi fadeInRightShort back-1">
        <div class="post-time-wrapper">
          
          <time>2020-08-01</time>
          
        </div>
      </div>
      <h2 class="post-title syuanpi fadeInRightShort back-2">
        
          Pwn题里有关seccomp和prctl函数的知识点小结
        
      </h2>
    </header>
    <div class="post-content syuanpi fadeInRightShort back-3">
      
        <h1 id="写在正文之前"><a href="#写在正文之前" class="headerlink" title="写在正文之前"></a>写在正文之前</h1><p>本文用于记录Pwn题里有关seccomp和prctl函数的知识点，其中很大一部分归纳于Linux下使用<code>man seccomp</code>和<code>man prctl</code>命令获得的帮助文档，有部分是个人的理解，翻译（渣翻，英语水平不好，会结合谷歌翻译），还有部分是参考许多大佬的文章。</p>
<p>部分参考文章：<a href="https://www.anquanke.com/post/id/208364" target="_blank" rel="noopener">Seccomp从0到1</a></p>
<p>(博主还是菜鸟，有些知识可能理解不够透彻，有些表述可能不够严谨，欢迎大家指正，望大家多多包涵)</p>
<a id="more"></a>

<h1 id="seccomp函数"><a href="#seccomp函数" class="headerlink" title="seccomp函数"></a>seccomp函数</h1><p>这个函数在man上解释是：</p>
<blockquote>
<p>The  seccomp()  system  call operates on the Secure Computing (seccomp)state of the calling process.</p>
<p>（seccomp（）系统调用在调用进程的安全计算（seccomp）状态下运行）</p>
</blockquote>
<p>从它的功能上看，说白了其实就是限制了程序对系统调用的使用，而在Pwn题中，某些情况（比如栈溢出的<code>ret2syscall</code>和某些<code>ret2shellcode</code>方法）是需要使用系统调用的，所以某些禁用了<code>execve</code>系统调用的程序就不能使用<code>system</code>函数，也就不能直接打开一个shell。</p>
<h2 id="seccomp函数原型："><a href="#seccomp函数原型：" class="headerlink" title="seccomp函数原型："></a>seccomp函数原型：</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">seccomp</span><span class="params">(<span class="keyword">unsigned</span> <span class="keyword">int</span> operation, <span class="keyword">unsigned</span> <span class="keyword">int</span> flags, <span class="keyword">void</span> *args)</span></span>;</span><br></pre></td></tr></table></figure>

<h2 id="常用operation参数："><a href="#常用operation参数：" class="headerlink" title="常用operation参数："></a>常用operation参数：</h2><p><strong>SECCOMP_SET_MODE_STRICT</strong>：    （1）</p>
<p>​    只允许当前线程使用<code>read</code>，<code>write</code>，<code>_exit</code>，<code>sigreturn</code>几个系统调用，其他的会抛出<code>SIGKILL</code>错误。</p>
<p>相当于<code>prctl(PR_SET_SECCOMP, SECCOMP_MODE_STRICT)</code>即<code>prctl(22,1)</code>这个语句的作用。</p>
<p><strong>SECCOMP_SET_MODE_FILTER</strong>：    （2）</p>
<p>​    可以使用<code>BPF(Berkeley Packet Filter)</code>来自定义规则来限制系统调用。</p>
<p>要使用这个参数，必须先设置好这个<code>prctl(PR_SET_NO_NEW_PRIVS, 1)</code>即<code>prctl(38,1)</code>。</p>
<p>这时当flags为0时相当于<code>prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, args)</code>即<code>prctl(22,2,args)</code></p>
<h2 id="常用的flags参数"><a href="#常用的flags参数" class="headerlink" title="常用的flags参数"></a>常用的flags参数</h2><p><strong>SECCOMP_FILTER_FLAG_TSYNC</strong>：    （1）</p>
<blockquote>
<p>When  adding  a new filter, synchronize all other threads of the calling process to the same seccomp  filter  tree.</p>
<p>（个人认为就是将规则应用到程序的所有线程中，但是我没有做过实验）</p>
</blockquote>
<p>SECCOMP_FILTER_FLAG_LOG    （2）<br>SECCOMP_FILTER_FLAG_SPEC_ALLOW    （4）</p>
<h2 id="其他"><a href="#其他" class="headerlink" title="其他"></a>其他</h2><p><code>BPF</code>就不详细介绍了，可以利用<a href="https://github.com/david942j/seccomp-tools" target="_blank" rel="noopener">seccomp-tools</a>来写。</p>
<h1 id="seccomp库函数"><a href="#seccomp库函数" class="headerlink" title="seccomp库函数"></a>seccomp库函数</h1><p>Ubuntu下可以使用命令先下载<code>sudo apt install libseccomp-dev libseccomp2 seccomp</code>，然后文件在<code>/usr/include/seccomp.h</code>。</p>
<p>使用这个库就可以在不了解<code>BPF</code>的情况下设计规则。</p>
<p>这里介绍一下我曾经遇到过的几个函数</p>
<h2 id="seccomp-init函数"><a href="#seccomp-init函数" class="headerlink" title="seccomp_init函数"></a>seccomp_init函数</h2><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="function">scmp_filter_ctx <span class="title">seccomp_init</span><span class="params">(<span class="keyword">uint32_t</span> def_action)</span></span>;<span class="comment">//原型</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">功能：初始化过滤器状态</span></span><br><span class="line"><span class="comment">参数：def_action为默认过滤器动作</span></span><br><span class="line"><span class="comment">返回：scmp_filter_ctx是一个void指针</span></span><br><span class="line"><span class="comment">*/</span></span><br></pre></td></tr></table></figure>

<h3 id="def-action参数"><a href="#def-action参数" class="headerlink" title="def_action参数"></a>def_action参数</h3><figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">define</span> SCMP_ACT_KILL_PROCESS	0x80000000U</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">大致与SCMP_ACT_KILL相同，区别是这一个是全部线程结束。</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> SCMP_ACT_KILL_THREAD	0x00000000U</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">同SCMP_ACT_KILL</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> SCMP_ACT_KILL		SCMP_ACT_KILL_THREAD</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">“白名单”模式，使用系统调用且没匹配到规则时抛出SIGSYS，并终止线程，线程不会收到信号。</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> SCMP_ACT_TRAP		0x00030000U</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">没太看懂……，其中也是“白名单”模式，未匹配到规则时抛出SIGSYS并执行一些操作</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> SCMP_ACT_ERRNO(x)	(0x00050000U | ((x) &amp; 0x0000ffffU))</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">“白名单”模式，未匹配到规则时返回errno的值</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> SCMP_ACT_TRACE(x)	(0x7ff00000U | ((x) &amp; 0x0000ffffU))</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">……</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> SCMP_ACT_LOG		0x7ffc0000U</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">“白名单”模式，未匹配到规则时会被记录，其他情况无影响</span></span><br><span class="line"><span class="comment">*/</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> SCMP_ACT_ALLOW		0x7fff0000U</span></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment">“黑名单”模式，匹配到规则会有影响</span></span><br><span class="line"><span class="comment">*/</span></span><br></pre></td></tr></table></figure>

<h2 id="seccomp-rule-add函数"><a href="#seccomp-rule-add函数" class="headerlink" title="seccomp_rule_add函数"></a>seccomp_rule_add函数</h2><p>添加规则用的函数。</p>
<p>原型：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">seccomp_rule_add</span><span class="params">(scmp_filter_ctx ctx, <span class="keyword">uint32_t</span> action,</span></span></span><br><span class="line"><span class="function"><span class="params">                            <span class="keyword">int</span> syscall, <span class="keyword">unsigned</span> <span class="keyword">int</span> arg_cnt, ...)</span></span>;</span><br></pre></td></tr></table></figure>

<h3 id="action参数"><a href="#action参数" class="headerlink" title="action参数"></a>action参数</h3><p>基本与seccomp_init的参数一样。</p>
<h3 id="syscall参数"><a href="#syscall参数" class="headerlink" title="syscall参数"></a>syscall参数</h3><p>指的是对应系统调用的编号。</p>
<h3 id="arg-cnt参数"><a href="#arg-cnt参数" class="headerlink" title="arg_cnt参数"></a>arg_cnt参数</h3><p>arg_array参数中的元素数</p>
<h3 id="arg-array（…）参数"><a href="#arg-array（…）参数" class="headerlink" title="arg_array（…）参数"></a>arg_array（…）参数</h3><p>scmp_arg_cmp结构的数组</p>
<h2 id="seccomp-load函数"><a href="#seccomp-load函数" class="headerlink" title="seccomp_load函数"></a>seccomp_load函数</h2><p>这个函数是将之前设置好的seccomp规则导入到内核中真正的执行。</p>
<p>函数原型：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">seccomp_load</span><span class="params">(scmp_filter_ctx ctx)</span></span></span><br></pre></td></tr></table></figure>

<h1 id="prctl函数"><a href="#prctl函数" class="headerlink" title="prctl函数"></a>prctl函数</h1><p>进程控制函数</p>
<p>函数原型：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">prctl</span><span class="params">(<span class="keyword">int</span> option, <span class="keyword">unsigned</span> <span class="keyword">long</span> arg2, <span class="keyword">unsigned</span> <span class="keyword">long</span> arg3,</span></span></span><br><span class="line"><span class="function"><span class="params">                 <span class="keyword">unsigned</span> <span class="keyword">long</span> arg4, <span class="keyword">unsigned</span> <span class="keyword">long</span> arg5)</span></span>;</span><br></pre></td></tr></table></figure>

<p>参数比较复杂，这里我就把<code>/usr/include/linux/prctl.h</code>文件贴出来了：</p>
<blockquote>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br><span class="line">188</span><br><span class="line">189</span><br><span class="line">190</span><br><span class="line">191</span><br><span class="line">192</span><br><span class="line">193</span><br><span class="line">194</span><br><span class="line">195</span><br><span class="line">196</span><br><span class="line">197</span><br><span class="line">198</span><br><span class="line">199</span><br><span class="line">200</span><br><span class="line">201</span><br><span class="line">202</span><br><span class="line">203</span><br><span class="line">204</span><br><span class="line">205</span><br><span class="line">206</span><br><span class="line">207</span><br><span class="line">208</span><br><span class="line">209</span><br><span class="line">210</span><br><span class="line">211</span><br><span class="line">212</span><br><span class="line">213</span><br><span class="line">214</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">#<span class="meta-keyword">ifndef</span> _LINUX_PRCTL_H</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> _LINUX_PRCTL_H</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">include</span> <span class="meta-string">&lt;linux/types.h&gt;</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Values to pass as first argument to prctl() */</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_PDEATHSIG  1  <span class="comment">/* Second arg is a signal */</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_PDEATHSIG  2  <span class="comment">/* Second arg is a ptr to return the signal */</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set current-&gt;mm-&gt;dumpable */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_DUMPABLE   3</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_DUMPABLE   4</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set unaligned access control bits (if meaningful) */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_UNALIGN	  5</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_UNALIGN	  6</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_UNALIGN_NOPRINT	1	<span class="comment">/* silently fix up unaligned user accesses */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_UNALIGN_SIGBUS	2	<span class="comment">/* generate SIGBUS on unaligned user access */</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set whether or not to drop capabilities on setuid() away from</span></span><br><span class="line"><span class="comment"> * uid 0 (as per security/commoncap.c) */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_KEEPCAPS   7</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_KEEPCAPS   8</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set floating-point emulation control bits (if meaningful) */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_FPEMU  9</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_FPEMU 10</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FPEMU_NOPRINT	1	<span class="comment">/* silently emulate fp operations accesses */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FPEMU_SIGFPE	2	<span class="comment">/* don't emulate fp operations, send SIGFPE instead */</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set floating-point exception mode (if meaningful) */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_FPEXC	11</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_FPEXC	12</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_SW_ENABLE	0x80	<span class="comment">/* Use FPEXC for FP exception enables */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_DIV		0x010000	<span class="comment">/* floating point divide by zero */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_OVF		0x020000	<span class="comment">/* floating point overflow */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_UND		0x040000	<span class="comment">/* floating point underflow */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_RES		0x080000	<span class="comment">/* floating point inexact result */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_INV		0x100000	<span class="comment">/* floating point invalid operation */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_DISABLED	0	<span class="comment">/* FP exceptions disabled */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_NONRECOV	1	<span class="comment">/* async non-recoverable exc. mode */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_ASYNC	2	<span class="comment">/* async recoverable exception mode */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_EXC_PRECISE	3	<span class="comment">/* precise exception mode */</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set whether we use statistical process timing or accurate timestamp</span></span><br><span class="line"><span class="comment"> * based process timing */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_TIMING   13</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_TIMING   14</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_TIMING_STATISTICAL  0       <span class="comment">/* Normal, traditional,</span></span></span><br><span class="line"><span class="meta"><span class="comment">                                                   statistical process timing */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_TIMING_TIMESTAMP    1       <span class="comment">/* Accurate timestamp based</span></span></span><br><span class="line"><span class="meta"><span class="comment">                                                   process timing */</span></span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_NAME    15		<span class="comment">/* Set process name */</span></span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_NAME    16		<span class="comment">/* Get process name */</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set process endian */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_ENDIAN	19</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_ENDIAN	20</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_ENDIAN_BIG		0</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_ENDIAN_LITTLE	1	<span class="comment">/* True little endian mode */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_ENDIAN_PPC_LITTLE	2	<span class="comment">/* "PowerPC" pseudo little endian */</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set process seccomp mode */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_SECCOMP	21</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_SECCOMP	22</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set the capability bounding set (as per security/commoncap.c) */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_CAPBSET_READ 23</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_CAPBSET_DROP 24</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set the process' ability to use the timestamp counter instruction */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_TSC 25</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_TSC 26</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_TSC_ENABLE		1	<span class="comment">/* allow the use of the timestamp counter */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_TSC_SIGSEGV		2	<span class="comment">/* throw a SIGSEGV instead of reading the TSC */</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Get/set securebits (as per security/commoncap.c) */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_SECUREBITS 27</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_SECUREBITS 28</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Get/set the timerslack as used by poll/select/nanosleep</span></span><br><span class="line"><span class="comment"> * A value of 0 means "use default"</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_TIMERSLACK 29</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_TIMERSLACK 30</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_TASK_PERF_EVENTS_DISABLE		31</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_TASK_PERF_EVENTS_ENABLE		32</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Set early/late kill mode for hwpoison memory corruption.</span></span><br><span class="line"><span class="comment"> * This influences when the process gets killed on a memory corruption.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_MCE_KILL	33</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_MCE_KILL_CLEAR   0</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_MCE_KILL_SET     1</span></span><br><span class="line"></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_MCE_KILL_LATE    0</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_MCE_KILL_EARLY   1</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_MCE_KILL_DEFAULT 2</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_MCE_KILL_GET 34</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Tune up process memory map specifics.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_MM		35</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_START_CODE		1</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_END_CODE		2</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_START_DATA		3</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_END_DATA		4</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_START_STACK		5</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_START_BRK		6</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_BRK			7</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_ARG_START		8</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_ARG_END		9</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_ENV_START		10</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_ENV_END		11</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_AUXV			12</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_EXE_FILE		13</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_MAP			14</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_MM_MAP_SIZE		15</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * This structure provides new memory descriptor</span></span><br><span class="line"><span class="comment"> * map which mostly modifies /proc/pid/stat[m]</span></span><br><span class="line"><span class="comment"> * output for a task. This mostly done in a</span></span><br><span class="line"><span class="comment"> * sake of checkpoint/restore functionality.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="class"><span class="keyword">struct</span> <span class="title">prctl_mm_map</span> &#123;</span></span><br><span class="line">	__u64	start_code;		<span class="comment">/* code section bounds */</span></span><br><span class="line">	__u64	end_code;</span><br><span class="line">	__u64	start_data;		<span class="comment">/* data section bounds */</span></span><br><span class="line">	__u64	end_data;</span><br><span class="line">	__u64	start_brk;		<span class="comment">/* heap for brk() syscall */</span></span><br><span class="line">	__u64	brk;</span><br><span class="line">	__u64	start_stack;		<span class="comment">/* stack starts at */</span></span><br><span class="line">	__u64	arg_start;		<span class="comment">/* command line arguments bounds */</span></span><br><span class="line">	__u64	arg_end;</span><br><span class="line">	__u64	env_start;		<span class="comment">/* environment variables bounds */</span></span><br><span class="line">	__u64	env_end;</span><br><span class="line">	__u64	*auxv;			<span class="comment">/* auxiliary vector */</span></span><br><span class="line">	__u32	auxv_size;		<span class="comment">/* vector size */</span></span><br><span class="line">	__u32	exe_fd;			<span class="comment">/* /proc/$pid/exe link file */</span></span><br><span class="line">&#125;;</span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Set specific pid that is allowed to ptrace the current task.</span></span><br><span class="line"><span class="comment"> * A value of 0 mean "no process".</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_PTRACER 0x59616d61</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SET_PTRACER_ANY ((unsigned long)-1)</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_CHILD_SUBREAPER	36</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_CHILD_SUBREAPER	37</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * If no_new_privs is set, then operations that grant new privileges (i.e.</span></span><br><span class="line"><span class="comment"> * execve) will either fail or not grant them.  This affects suid/sgid,</span></span><br><span class="line"><span class="comment"> * file capabilities, and LSMs.</span></span><br><span class="line"><span class="comment"> *</span></span><br><span class="line"><span class="comment"> * Operations that merely manipulate or drop existing privileges (setresuid,</span></span><br><span class="line"><span class="comment"> * capset, etc.) will still work.  Drop those privileges if you want them gone.</span></span><br><span class="line"><span class="comment"> *</span></span><br><span class="line"><span class="comment"> * Changing LSM security domain is considered a new privilege.  So, for example,</span></span><br><span class="line"><span class="comment"> * asking selinux for a specific new context (e.g. with runcon) will result</span></span><br><span class="line"><span class="comment"> * in execve returning -EPERM.</span></span><br><span class="line"><span class="comment"> *</span></span><br><span class="line"><span class="comment"> * See Documentation/prctl/no_new_privs.txt for more details.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_NO_NEW_PRIVS	38</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_NO_NEW_PRIVS	39</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_TID_ADDRESS	40</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_THP_DISABLE	41</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_THP_DISABLE	42</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/*</span></span><br><span class="line"><span class="comment"> * Tell the kernel to start/stop helping userspace manage bounds tables.</span></span><br><span class="line"><span class="comment"> */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_MPX_ENABLE_MANAGEMENT  43</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_MPX_DISABLE_MANAGEMENT 44</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_FP_MODE		45</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_FP_MODE		46</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_MODE_FR		(1 &lt;&lt; 0)	<span class="comment">/* 64b FP registers */</span></span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_FP_MODE_FRE		(1 &lt;&lt; 1)	<span class="comment">/* 32b compatibility */</span></span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Control the ambient capability set */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_CAP_AMBIENT			47</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_CAP_AMBIENT_IS_SET		1</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_CAP_AMBIENT_RAISE		2</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_CAP_AMBIENT_LOWER		3</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_CAP_AMBIENT_CLEAR_ALL	4</span></span><br><span class="line"></span><br><span class="line"><span class="comment">/* Per task speculation control */</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_GET_SPECULATION_CTRL		52</span></span><br><span class="line"><span class="meta">#<span class="meta-keyword">define</span> PR_SET_SPECULATION_CTRL		53</span></span><br><span class="line"><span class="comment">/* Speculation control variants */</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SPEC_STORE_BYPASS		0</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SPEC_INDIRECT_BRANCH	1</span></span><br><span class="line"><span class="comment">/* Return and control values for PR_SET/GET_SPECULATION_CTRL */</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SPEC_NOT_AFFECTED		0</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SPEC_PRCTL			(1UL &lt;&lt; 0)</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SPEC_ENABLE			(1UL &lt;&lt; 1)</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SPEC_DISABLE		(1UL &lt;&lt; 2)</span></span><br><span class="line"><span class="meta"># <span class="meta-keyword">define</span> PR_SPEC_FORCE_DISABLE		(1UL &lt;&lt; 3)</span></span><br><span class="line"></span><br><span class="line"><span class="meta">#<span class="meta-keyword">endif</span> <span class="comment">/* _LINUX_PRCTL_H */</span></span></span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>来源：Ubuntu16.04的<code>/usr/include/linux/prctl.h</code>文件</p>
</blockquote>

      
    
    </div>
    
      <div class="post-tags syuanpi fadeInRightShort back-3">
      
        <a href="/blog/tags/%E7%9F%A5%E8%AF%86%E7%82%B9%E8%AE%B0%E5%BD%95/">知识点记录</a>
      
      </div>
    
    
      

      
  <hr class="copy-line">
  <div class="post-copyright">
    <div class="copy-author">
      <span>作者 :</span>
      <span>Axojhf</span>
    </div>
    <div class="copy-url">
      <span>地址 :</span>
      <a href="http://xiaoaoaode.gitee.io/blog/2020/08/01/8e1ab4ab/">http://xiaoaoaode.gitee.io/blog/2020/08/01/8e1ab4ab/</a>
    </div>
    <div class="copy-origin">
      <span>来源 :</span>
      <a href="http://xiaoaoaode.gitee.io/blog">http://xiaoaoaode.gitee.io/blog</a>
    </div>
    <div class="copy-license">
      
      著作权归作者所有，转载请联系作者获得授权。
    </div>
  </div>

    
  </article>
  
    
  <nav class="article-page">
    
      <a href="/blog/2020/08/07/38a4c9bb/" id="art-left" class="art-left">
        <span class="next-title">
          <i class="iconfont icon-left"></i>Pwn环境的搭建和解答一些简单Pwn题的分享
        </span>
      </a>
    
    
      <a href="/blog/2020/07/28/cfa15dd3/" id="art-right" class="art-right">
        <span class="prev-title">
          BUUCTF-Pwn题-Writeup（2）<i class="iconfont icon-right"></i>
        </span>
      </a>
    
  </nav>


    
  <i id="com-switch" class="iconfont icon-down jumping-in long infinite" style="font-size:24px;display:block;text-align:center;transform:rotate(180deg);"></i>
  <div class="post-comments" id="post-comments" style="display: block;margin: auto 16px;">
    

    
    

    

  </div>



  
  
    
  
  <aside class="post-toc">
    <div class="title"><span>文章导航</span></div>
    <div class="toc-inner">
      <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#写在正文之前"><span class="toc-text">写在正文之前</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#seccomp函数"><span class="toc-text">seccomp函数</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#seccomp函数原型："><span class="toc-text">seccomp函数原型：</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#常用operation参数："><span class="toc-text">常用operation参数：</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#常用的flags参数"><span class="toc-text">常用的flags参数</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#其他"><span class="toc-text">其他</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#seccomp库函数"><span class="toc-text">seccomp库函数</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#seccomp-init函数"><span class="toc-text">seccomp_init函数</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#def-action参数"><span class="toc-text">def_action参数</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#seccomp-rule-add函数"><span class="toc-text">seccomp_rule_add函数</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#action参数"><span class="toc-text">action参数</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#syscall参数"><span class="toc-text">syscall参数</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#arg-cnt参数"><span class="toc-text">arg_cnt参数</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#arg-array（…）参数"><span class="toc-text">arg_array（…）参数</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#seccomp-load函数"><span class="toc-text">seccomp_load函数</span></a></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#prctl函数"><span class="toc-text">prctl函数</span></a></li></ol>
    </div>
  </aside>



  


        </div>
      </main>
      <footer class="footer syuanpi fadeIn" id="footer">
  <hr>
  <div class="footer-wrapper">
    <div class="left">
      <div class="contact-icon">
  
  
</div>

    </div>
    <div class="right">
      <div class="copyright">
    <div class="info">
        <span>&copy;</span>
        <span>2020 ~ 2020</span>
        <span>❤</span>
        <span>Axojhf</span>
    </div>
    <div class="theme">
        <span>
            动力来源于
            <a href="http://hexo.io/" target="_blank" rel="noopener">Hexo </a>
        </span>
        <span>
            主题
            <a href="https://github.com/ColMugX/hexo-theme-Nlvi" target="_blank" rel="noopener"> Nlvi </a>
        </span>
    </div>
    
</div>

    </div>
  </div>
</footer>
    </div>
    <div class="tagcloud" id="tagcloud">
  <div class="tagcloud-taglist">
  
    <div class="tagcloud-tag">
      <button>Writeup</button>
    </div>
  
    <div class="tagcloud-tag">
      <button>其他</button>
    </div>
  
    <div class="tagcloud-tag">
      <button>知识点记录</button>
    </div>
  
  </div>
  
    <div class="tagcloud-postlist active">
      <h2>Writeup</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/27/dd14f23d/">
            <time class="tagcloud-posttime">2020 / 07 / 27</time>
            <span>BUUCTF-Pwn题-Writeup（1）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/28/cfa15dd3/">
            <time class="tagcloud-posttime">2020 / 07 / 28</time>
            <span>BUUCTF-Pwn题-Writeup（2）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/16/771d3ab6/">
            <time class="tagcloud-posttime">2020 / 08 / 16</time>
            <span>BUUCTF-Pwn题-Writeup（3）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/19/5276656a/">
            <time class="tagcloud-posttime">2020 / 08 / 19</time>
            <span>BUUCTF-Pwn题-Writeup（5）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/17/eaca020f/">
            <time class="tagcloud-posttime">2020 / 08 / 17</time>
            <span>BUUCTF-Pwn题-Writeup（4）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/21/f87fade1/">
            <time class="tagcloud-posttime">2020 / 09 / 21</time>
            <span>BUUCTF-Pwn题-Writeup（7）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/04/40c3ca84/">
            <time class="tagcloud-posttime">2020 / 09 / 04</time>
            <span>BUUCTF-Pwn题-Writeup（6）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/09/28/a01cbdb7/">
            <time class="tagcloud-posttime">2020 / 09 / 28</time>
            <span>BUUCTF-Pwn题-Writeup（8）</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/31/2253bdbe/">
            <time class="tagcloud-posttime">2020 / 08 / 31</time>
            <span>DASCTF2020八月赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/26/253f1adb/">
            <time class="tagcloud-posttime">2020 / 07 / 26</time>
            <span>DASCTF七月赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/24/49582296/">
            <time class="tagcloud-posttime">2020 / 08 / 24</time>
            <span>CISCN2020初赛个人Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/01/14185/">
            <time class="tagcloud-posttime">2020 / 06 / 01</time>
            <span>我写出来的招新题的Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/17/45ae5a23/">
            <time class="tagcloud-posttime">2020 / 06 / 17</time>
            <span>攻防世界-“250”题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/09/7b438d60/">
            <time class="tagcloud-posttime">2020 / 06 / 09</time>
            <span>攻防世界-babyheap题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/17/47cfb24f/">
            <time class="tagcloud-posttime">2020 / 06 / 17</time>
            <span>攻防世界-“Recho”题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/12/e563c85c/">
            <time class="tagcloud-posttime">2020 / 07 / 12</time>
            <span>攻防世界-magic题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/10/07/9b619749/">
            <time class="tagcloud-posttime">2020 / 10 / 07</time>
            <span>攻防世界-nobug题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/02/471a08d2/">
            <time class="tagcloud-posttime">2020 / 06 / 02</time>
            <span>攻防世界--supermarket题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/10/04/77eb8480/">
            <time class="tagcloud-posttime">2020 / 10 / 04</time>
            <span>攻防世界-onemanarmy题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/02/a54507f8/">
            <time class="tagcloud-posttime">2020 / 06 / 02</time>
            <span>攻防世界——dice_game题Writeup</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/06/10/928398a1/">
            <time class="tagcloud-posttime">2020 / 06 / 10</time>
            <span>攻防世界-"实时数据监测"题Writeup</span>
          </a>
        </div>
      
    </div>
  
    <div class="tagcloud-postlist ">
      <h2>其他</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/07/38a4c9bb/">
            <time class="tagcloud-posttime">2020 / 08 / 07</time>
            <span>Pwn环境的搭建和解答一些简单Pwn题的分享</span>
          </a>
        </div>
      
    </div>
  
    <div class="tagcloud-postlist ">
      <h2>知识点记录</h2>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/10/44355a63/">
            <time class="tagcloud-posttime">2020 / 08 / 10</time>
            <span>_IO_FILE结构与fread函数知识点小结</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/08/01/8e1ab4ab/">
            <time class="tagcloud-posttime">2020 / 08 / 01</time>
            <span>Pwn题里有关seccomp和prctl函数的知识点小结</span>
          </a>
        </div>
      
        <div class="tagcloud-post">
          <a href="/blog/2020/07/19/5cfa9d84/">
            <time class="tagcloud-posttime">2020 / 07 / 19</time>
            <span>正则表达式学习1</span>
          </a>
        </div>
      
    </div>
  
</div>

  </div>
  <div class="backtop syuanpi melt toTop" id="backtop">
    <i class="iconfont icon-up"></i>
    <span style="text-align:center;font-family:Georgia;"><span style="font-family:Georgia;" id="scrollpercent">1</span>%</span>
</div>

  <div class="search" id="search">
    <div class="input">
      <input type="text" id="search-input" placeholder="搜索一下？" autofocus>
    </div>
    <div id="search-result"></div>
  </div>



<script src="https://cdn.jsdelivr.net/npm/jquery@3.4.1/dist/jquery.min.js"></script>



  <script></script>
  <script src="/blog/script/lib/lightbox/js/lightbox.min.js" async></script>











  
<script src="/blog/script/scheme/banderole.js"></script>




<script src="/blog/script/bootstarp.js"></script>



<script>
if (nlviconfig.theme.toc) {
  setTimeout(function() {
    if (nlviconfig.theme.scheme === 'balance') {
      $("#header").addClass("show_toc");
    } else if (nlviconfig.theme.scheme === 'banderole') {
      $(".container-inner").addClass("has_toc");
      $(".post-toc .title").addClass("show");
      $(".toc-inner").addClass("show");
    }
  }, 1000);
}
</script>



</body>
</html>
